Runs an essential service, in Kenya

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 11 · Read the law's page

• This binds the owner or operator of a system that the Director of the National Computer and Cybercrimes Co-ordination Committee has designated as critical infrastructure by notice in the Kenya Gazette under section 9(1) of the Act (reached by declaring that you operate an essential service), and does not bind an owner or operator of a system that has not been designated. A system is designated by reference to the effects of its disruption that section 9(2) lists, which include the interruption of a life sustaining service such as the supply of water, health services and energy, an adverse effect on the economy of the Republic, massive casualties or fatalities, and disruption of the money market of the Republic.
• Report to the National Computer and Cybercrimes Co-ordination Committee any incident likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime, together with the action you intend to take to prevent the threat (section 11(1)).

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Computer Misuse and Cybercrimes Act (No. 5 of 2018), ss. 9 and 13 · Read the law's page

• This binds the owner or operator of a system that the Director of the National Computer and Cybercrimes Co-ordination Committee has designated as critical infrastructure by notice in the Kenya Gazette under section 9(1) of the Act (reached by declaring that you operate an essential service), and does not bind an owner or operator of a system that has not been designated. A system is designated by reference to the effects of its disruption that section 9(2) lists, which include the interruption of a life sustaining service such as the supply of water, health services and energy, an adverse effect on the economy of the Republic, massive casualties or fatalities, and disruption of the money market of the Republic.
• Comply, within the period the Director sets, with the directives the Director issues for the critical information infrastructure on the classification of data, the protection, storing and archiving of data, cyber security incident management, disaster contingency and recovery measures, and minimum physical and technical security measures (section 9(4)).
• Submit a compliance report on the critical information infrastructure to the Committee every year, in line with a critical infrastructure framework (section 13(1)).
• Cooperate with an audit of the critical information infrastructure: assist and provide technical assistance to a person authorised to carry out the audit, and provide the Director with any additional information requested within the specified period (section 13(5)(b), (e) and (f)).

Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), reg. 65 · Read the law's page

• Report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident (regulation 65(c)). The Regulator of the specific Sector in which the infrastructure is domiciled or, where applicable, the relevant Ministry is the Sector Cybersecurity Operation Centre (regulation 11(1)).
• In the event of a cybersecurity incident, facilitate the investigations by law enforcement agencies, and report and mitigate the impact of the incident in accordance with the cybersecurity standards formulated by the Committee (regulation 65(a) and (b)).
• This binds an owner of critical information infrastructure, which includes the operator or authorized person in control of it, where the infrastructure is a system the Director has designated under section 9 of the Computer Misuse and Cybercrimes Act, 2018 by notice in the Kenya Gazette (reached by declaring that you operate an essential service); it does not bind the owner of a system that has not been designated. The Regulations apply to the public sector and the private sector (regulation 5).

Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024 (Legal Notice No. 44 of 2024), regs. 28 to 34, 42 and 46 · Read the law's page

• Implement the Director's directives within the time specified in the notice the Director issues on designation, and implement effective measures for the physical security of the hardware where the system is located, limits on access to the infrastructure and the information stored in it, periodic maintenance and security testing, prompt access for authorized persons during an incident or an audit, administrative control of the personnel who have access, limits on removable storage devices, and preparedness plans against damage, breach or loss (regulation 29(1) and (2)).
• Develop and implement an internal cybersecurity policy and review it at least annually (regulation 31(1)(a)). Adopt the technical and organizational measures regulation 31(2) lists, which include identifying and cataloguing all assets, security monitoring and response for timely detection of incidents, a business continuity and disaster recovery plan that is periodically tested and updated, an annual cybersecurity risk assessment, annual cybersecurity internal audits, a cybersecurity risk register, and cybersecurity exercises and drills with the Committee.
• Designate or appoint a Chief Information Security Officer (regulation 32(1)); owners may jointly appoint one officer who is accessible to each of them (regulation 32(2)). A person qualifies for the post if the person is a citizen of Kenya, has at least five years of demonstrable professional experience in the protection of critical information infrastructure and meets the other conditions in regulation 33.
• Formulate, and then review and update every year, organizational policies, procedures and codes of practice for the protection, preservation and management of the critical information infrastructure, a duty that fell due within six months of the commencement of the Regulations on 9 February 2024 (regulation 34(1)).
• Keep the infrastructure on which critical information is domiciled in Kenya, unless you apply to the Committee in Form CMCA 3 to locate critical information outside Kenya (regulation 28(1) and (2)).
• Establish a disaster recovery and backup site located in a different location from the main location of the critical information infrastructure (regulation 42(1)).
• In the annual compliance report you submit under section 13(1) of the Act, include a risk assessment specifying the risks the infrastructure is prone to and the mitigation measures you may apply, and your cybersecurity risk register (regulation 46(2)).
• This binds an owner of critical information infrastructure, which includes the operator or authorized person in control of it, where the infrastructure is a system the Director has designated under section 9 of the Computer Misuse and Cybercrimes Act, 2018 by notice in the Kenya Gazette (reached by declaring that you operate an essential service); it does not bind the owner of a system that has not been designated. The Regulations apply to the public sector and the private sector (regulation 5).